Module encapsulate 

Encapsulation (single-party — anyone can encrypt).

Threshold KEM encapsulation is identical to single-party KEM encapsulation: generate an ephemeral keypair, derive the shared secret, encrypt the shared secret to the recipient’s public key. The difference is in decapsulation: T-of-N parties must collaborate.

Structs

EncapsulatedKey

An encapsulated key — produced by encapsulate, consumed by threshold decapsulate.

MockEncapsulator

In-memory test encapsulator for “mock” algorithm.

SharedSecret

The shared secret derived during encapsulation. The encryptor uses this as the AEAD key to encrypt the actual plaintext.

ThresholdPublicKey

The recipient’s threshold public key (algorithm-agnostic bytes).

Enums

EncapsulateError

Errors during encapsulation.

Traits

Encapsulator

Trait for algorithm implementations of threshold KEM encapsulation.

Functions

encapsulate_mock

Convenience function: encapsulate using the mock encapsulator.

validate_share_for_algorithm

Marker for the decapsulator side — verifies the share is for the right algorithm.